                (get-in response [:session :csrf-token]) =not=> "staleCSRFtoken"))
 
        (fact "posting to authorisation endpoint redirects to callback with auth code and adds the client to the user's authorised clients"
-             (let [user (user/store-user! @storage/user-store user-email "password")
+             (let [user-store (m/create-memory-store)
+                   user (user/store-user! user-store user-email "password")
                    client-details (cl-client/register-client @storage/client-store "MYAPP" "myapp.com")
                    access-token (cl-token/create-token @storage/token-store client-details user)
                    csrf-token "CSRF-TOKEN"

            (encode-client-info client)))

(facts "about token endpoint"
       (let [user (user/store-user! @storage/user-store user-email "password")
             client-details (cl-client/register-client @storage/client-store "MYAPP" "http://myapp.com")
             auth-code (cl-auth-code/create-auth-code @storage/auth-code-store client-details user "http://myapp.com/callback")
             request (-> (th/create-request-with-query-string :get (routes/path :validate-token) {:grant_type   "authorization_code"
                                                                                                  :redirect_uri "http://myapp.com/callback"
                                                                                                  :code         (:code auth-code)})
                         (create-auth-header client-details))
             response (oauth/validate-token @storage/user-store request)
             response-body (-> response :body (json/parse-string keyword))]

         (fact "request with grant type authorization_code and correct credentials returns access token"

                               (assoc-in [:session :csrf-token] csrf-token)
                               (assoc :content-type "application/x-www-form-urlencoded") ;To mock a form post
                               (assoc-in [:session :user-login] user-email))]
               (oauth/authorise-client user-store request) => (contains {:status 302 :headers (contains {"Location" (contains "callback?code=")})})
               (provided
                 (user/add-authorised-client-for-user! user-store user-email anything) => ...user...)))

       (fact "valid request redirects to callback with auth code when there is an existing user session and the user has previously authorised the app"
             (let [user-store (m/create-memory-store)
                   user (user/store-user! user-store user-email "password")
                   client-details (cl-client/register-client @storage/client-store "MYAPP" "https://myapp.com")
                   updated-user (user/add-authorised-client-for-user! user-store user-email (:client-id client-details))
                   access-token (cl-token/create-token @storage/token-store client-details user)
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)
                                                                    {:client_id    (:client-id client-details) :response_type "code"
                                                                     :redirect_uri "https://myapp.com/callback"})
                               (assoc-in [:session :access_token] (:token access-token))
                               (assoc-in [:session :user-login] (:login user)))
                   response (oauth/authorise user-store request)]
               (:status response) => 302
               (get-in response [:headers "Location"]) => (contains "callback?code=")))

       (fact "request to authorisation endpoint with an incorrect redirect url does not redirect to the invalid url"
             (let [user-store (m/create-memory-store)
                   user (user/store-user! user-store user-email "password")
                   client-details (cl-client/register-client @storage/client-store "MYAPP" "https://myapp.com")
                   updated-user (user/add-authorised-client-for-user! user-store user-email (:client-id client-details))
                   access-token (cl-token/create-token @storage/token-store client-details user)
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)
                                                                    {:client_id    (:client-id client-details) :response_type "code"
                                                                     :redirect_uri "https://invalidcallback.com"})
                               (assoc-in [:session :access_token] (:token access-token))
                               (assoc-in [:session :user-login] (:login user)))
                   response (oauth/authorise user-store request)]
               (:status response) =not=> 302))

       (fact "return-to session key is refreshed when accessing authorisation endpoint without being signed in"
             (let [user-store (m/create-memory-store)
                   client-details (cl-client/register-client @storage/client-store "MYAPP" "https://myapp.com")
                   client-id (:client-id client-details)
                   redirect-uri "https://myapp.com/callback"
                   new-return-to-uri (->> {:uri          ...new-uri...
